Security & cyber
Secured to bank standard, ready for the quantum decade.
Security is not a layer added at the end. It sits in seven dimensions of every platform, model, agent and integration we build or run, and each control fails closed: if it cannot confirm a request is allowed, it blocks it.
- Information-security review cleared
- BankInformation-security review cleared
- Agent kill switch
- Under 1sAgent kill switch
- Recovery point, recovery time
- 1h, 4hRecovery point, recovery time
- Breach notification, from confirmation
- 72hBreach notification, from confirmation
Seven dimensions, each fail-closed.
Select a dimension to see its controls and the evidence your technology and risk teams can ask to see.
Dimension 1 of 7: Zero trust
Identity & access
Nobody is trusted because of where they sit on the network. Every request proves who it is, every time.
- Single sign-on through your own Microsoft Entra ID, with multi-factor authentication enforced
- Role-scoped access: each person sees only the data and outputs their role needs
- Just-in-time access for AlphaOmega support, approved per incident and revoked afterwards
- Every query and every output logged to an immutable audit trail
What you can ask to see
Access review export, audit-log sample, role matrix
What your technology and risk teams can ask to see.
Before data moves
Vendor security questionnaire
Your own questionnaire completed in full, with a technical session for your IT and risk teams.
In the contract
Data processing agreement
You as responsible party and AlphaOmega as operator under POPIA, with audit rights over our controls and access logs.
At go-live
The evidence pack
Bills of materials, penetration-test summary, data-flow diagram, sub-processor register and recovery-test results.
Every quarter
Security and model review
Access review, drift and bias monitoring, incidents and near misses, and the cryptographic migration register.
Every number carries a provenance class
Counted
Enumerated directly from a primary register: exchange listings, licence registers, filed returns. The strongest class.
Proven
Stated in an audited or officially filed document, cited to page and date. A client figure is cited as theirs.
Derived
AlphaOmega arithmetic on counted or proven inputs, with the method published alongside the result.
Modelled
Simulation output, confidence-banded and labelled, shown at lighter weight than evidence.
- ISO 27001 aligned
- NIST CSF 2.0 aligned
- POPIA
- GDPR & data residency
- EU AI Act high-risk framing
- King IV & King V
- Basel III operational risk
- FATF AML/CFT aware
Data stolen today can be read tomorrow.
A large enough quantum computer would break the public-key cryptography that protects almost every connection and signature in use today. Adversaries do not need to wait for it: data copied now can be decrypted later. What matters is how long a secret must stay secret, and how long the move to post-quantum standards takes.
The standards are set
Aug 2024
NIST publishes the first post-quantum standards
FIPS 203 (ML-KEM) for key exchange; FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for signatures.
Nov 2024
NIST sets the transition
NIST IR 8547, still in draft, proposes deprecating RSA and elliptic-curve cryptography after 2030 and disallowing them after 2035.
Mar 2025
A backup and a timetable
NIST selects HQC as a second key-exchange algorithm. The UK NCSC sets three milestones for migration.
2028
Discovery done
NCSC: migration goals set and a full inventory of cryptography completed.
2030–31
Priority systems moved
NIST draft: quantum-vulnerable algorithms deprecated. NCSC: highest-priority migration complete.
2035
Migration complete
NIST draft: quantum-vulnerable algorithms disallowed. NCSC: migration complete across all systems.
Is this data already exposed?
Your own assumption. Nobody knows the year.
Mosca’s test: the data is exposed if x + y is greater than z
Exposed by 8 years
Data encrypted today with quantum-vulnerable keys would still need to be secret 8 years after a quantum computer could read it. To have been safe, migration would have had to start by 2018. Data copied now is already a harvest target.
Mosca’s inequality, after Michele Mosca (University of Waterloo). The arrival year of a cryptographically relevant quantum computer is unknown; it is shown here as your assumption, not a forecast.
NIST FIPS 203–205 (13 Aug 2024); NIST IR 8547, initial public draft (Nov 2024), not yet final; NIST HQC selection (11 Mar 2025); UK NCSC, timelines for migration to post-quantum cryptography (20 Mar 2025).
A board cannot price a red square. It can price a loss in rand.
Most boards see cyber risk as a heat map. We put it in the language of the investment committee: how often, how much, how bad in a bad year, and what each control buys, using the same Monte Carlo engine that sizes revenue pools.
- Global average cost of a data breach
- US$4.99mGlobal average cost of a data breachIBM, Cost of a Data Breach 2026
- South African average cost of a data breach
- R44.1mSouth African average cost of a data breachIBM, Cost of a Data Breach 2025
- Malicious breaches that were AI-enabled
- 1 in 4Malicious breaches that were AI-enabledIBM, 2026
Cyber risk in rand
Loss frequency and severity quantified for the board and investment committee, with every control ranked by loss avoided per rand spent.
Holdings & third-party exposure
One method across a group, its largest holdings and their critical vendors, read through to value and reputation.
Cyber due diligence on deals
Cyber posture priced into screening, due diligence and the first hundred days.
Post-quantum readiness
The cryptographic inventory, long-life data, vendor exposure and a migration roadmap set against the NIST and NCSC timelines.
AI security & red teaming
Prompt injection, data leakage and agent misuse tested before release. Our own guardrails cleared a Top 40 JSE bank’s information-security review.
Incident readiness & board simulation
Playbooks, recovery tests and a live tabletop exercise for the board: the first 72 hours of a breach.
The rules your holdings already answer to
Financial-sector groups
Joint Standard 2 of 2024
The Prudential Authority and FSCA standard on cybersecurity and cyber resilience, in force since 1 June 2025, for regulated financial institutions including insurers.
Personal information
POPIA section 22
A security compromise must be reported to the Information Regulator and the people affected as soon as reasonably possible, through the Regulator’s online portal.
The governing body
King V
Published by the IoDSA on 31 October 2025 for financial years from 1 January 2026. The board governs data, information and technology so they support the strategy.
IBM, Cost of a Data Breach Report 2026 (29 Jul 2026) and 2025 (South African figure). Loss modelling in the spirit of Open FAIR.
Start with a technical session for your IT and risk teams.
We walk the seven dimensions, complete your vendor security questionnaire and agree the evidence pack before any data moves.